312 matches found
CVE-2022-24124
POC para CVE-2022-24124 Código de Exploit para CVE-2022-24124 también conocido como Casdoor SQL Injection Enlaces del Exploit: ExploitDB-50792 PacketStormSecurity Resultado esperado: Volcar la versión de la base de datos SQL en el host que ejecuta Casdoor 1.13.1 Destinado únicamente para fines...
Casdoor - Authorization Bypass
Casdoor up to 1.811.0 contains an authorization bypass caused by manipulation in HandleScim function in controllers/scim.go, letting remote attackers bypass authorization, exploit requires remote access. id: CVE-2025-4210 info: name: Casdoor - Authorization Bypass author: theamanrawat severity:...
CVE-2022-24124
前言 Casdoor是一个基于OAuth 2.0/OIDC的中心化的单点登录（SSO）身份验证平台 编号 CVE编号:CVE-2022-24124 CNPD编号:CNPD-202201-7304 影响版本 危险等级：高 7.5 HIGH POC/EXP：已公开 Casdoor POC: /api/get-organizations?p=123&pageSize=123&value=cfx&sortField=&sortOrder=&field=updatexml1,version,3 一键验证脚本 声明: 工具仅供安全研究或授权渗透，非法用途后果自负，作者并不承担任何责任以及连带责任...
csrf_casdoor
Casdoor – Cross-Site Request Forgery CSRF Summary Vulnerability: CSRF in /api/set-password allowing password changes without consent. Affected versions: All versions of the software are affected. No patched release is currently available. CVE: CVE-2023-34927 latest yet to be assigned. Exploit...
Casdoor 1.13.0 - Unauthenticated SQL Injection
Casdoor version 1.13.0 suffers from a remote unauthenticated SQL injection vulnerability via the query API in Casdoor before 1.13.1 related to the field and value parameters, as demonstrated by api/get-organizations. id: CVE-2022-24124 info: name: Casdoor 1.13.0 - Unauthenticated SQL Injection...
CVE-2022-24124
POC para CVE-2022-24124 Código de explotación para CVE-2022-24124 también conocido como inyección SQL de Casdoor Enlaces del exploit: ExploitDB-50792 PacketStormSecurity Resultado esperado: Volcar la versión de la base de datos SQL en el host que ejecuta Casdoor 1.13.1 Diseñado únicamente para...
CVE-2026-6815
CVE-2026-6815 PoC/Exploit: Casdoor 3.54.1 Path Traversal y Escritura Arbitraria de Archivos Autenticado Este repositorio contiene una prueba de concepto PoC para el exploit CVE-2026-6815, una vulnerabilidad de escritura arbitraria de archivos y path traversal en Casdoor. La vulnerabilidad ha sido...
CVE-2026-9090-poc
CVE-2026-9090 — Casdoor SAML Signature Bypass PoC Proof-of-concept for CVE-2026-9090 CWE-347, Improper Verification of Cryptographic Signature, an authentication bypass in the Casdoor identity platform. Attribution. CVE-2026-9090 was published and coordinated by CERT/CC — see VU780781. This...
EUVD-2026-69726
A vulnerability has been found in Casdoor up to 4.0.0. This affects an unknown function of the file controllers/resource.go of the component upload-resource API. Such manipulation leads to missing authentication. It is possible to launch the attack remotely. The exploit has been disclosed to the...
CVE-2026-84423
A vulnerability has been found in Casdoor up to 4.0.0. This affects an unknown function of the file controllers/resource.go of the component upload-resource API. Such manipulation leads to missing authentication. It is possible to launch the attack remotely. The exploit has been disclosed to the...
CVE-2026-84423 Casdoor upload-resource API resource.go missing authentication
A vulnerability has been found in Casdoor up to 4.0.0. This affects an unknown function of the file controllers/resource.go of the component upload-resource API. Such manipulation leads to missing authentication. It is possible to launch the attack remotely. The exploit has been disclosed to the...
CVE-2026-84423 Casdoor upload-resource API resource.go missing authentication
A vulnerability has been found in Casdoor up to 4.0.0. This affects an unknown function of the file controllers/resource.go of the component upload-resource API. Such manipulation leads to missing authentication. It is possible to launch the attack remotely. The exploit has been disclosed to the...
CVE-2026-84423
Casdoor versions up to 4.0.0 are affected by a missing authentication vulnerability in the upload-resource API , specifically in the controllers/resource.go file. The flaw allows a remote, unauthenticated attacker to perform an arbitrary file upload via the upload-resource endpoint. The exploit h...
PT-2026-84534
Name of the Vulnerable Software and Affected Versions Casdoor versions prior to 4.0.0 Description An issue exists in the upload-resource API within the controllers/resource.go file. This flaw allows remote attackers to bypass authentication, leading to missing authentication for the affected...
SUSE CVE-2026-6815
An arbitrary file write vulnerability exists in Casdoor's Local File System storage provider. Due to insufficient path sanitization, an authenticated attacker with administrative privileges can perform a Path Traversal attack to create or overwrite arbitrary files anywhere on the host filesystem,...
GO-2026-5945 Casdoor: Arbitrary file write possible through Local File System storage provider in github.com/casdoor/casdoor
Casdoor: Arbitrary file write possible through Local File System storage provider in github.com/casdoor/casdoor...
GO-2026-5953 Casdoor: GetTokenExchangeToken bypass through lack of cross-organization JWT signature check in github.com/casdoor/casdoor
Casdoor: GetTokenExchangeToken bypass through lack of cross-organization JWT signature check in github.com/casdoor/casdoor. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positi...
GO-2026-5899 Casdoor doesn't enforce SAML assertion time bounds in github.com/casdoor/casdoor
Casdoor doesn't enforce SAML assertion time bounds in github.com/casdoor/casdoor...
GO-2026-5898 Casdoor SAML callback handler accepts any well-formed SAMLResponse sent to /api/acs without verifying that it corresponds to an AuthnRequest in github.com/casdoor/casdoor
Casdoor SAML callback handler accepts any well-formed SAMLResponse sent to /api/acs without verifying that it corresponds to an AuthnRequest in github.com/casdoor/casdoor...